| CVE-2026-49176 | 7.8 | — | — | — | microsoft / windows 10 1607 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally | 92d ago |
| CVE-2026-49175 | 7.8 | — | — | — | microsoft / windows 10 21h2 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. | 92d ago |
| CVE-2026-49173 | 7.8 | — | — | — | microsoft / windows 11 26h1 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 92d ago |
| CVE-2026-49170 | 7.8 | — | — | — | microsoft / windows 10 1809 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate | 92d ago |
| CVE-2026-49166 | 7.8 | — | — | — | microsoft / windows 11 24h2 | Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. | 92d ago |
| CVE-2026-48581 | 7.8 | — | — | — | microsoft / surface go 2 1901 firmware | Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privilege | 92d ago |
| CVE-2026-44800 | 7.8 | — | — | — | microsoft / windows 11 23h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifi | 92d ago |
| CVE-2026-42982 | 7.8 | — | — | — | microsoft / windows 10 1607 | Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to ele | 92d ago |
| CVE-2026-10669 | 7.8 | — | — | — | zephyrproject / zephyr | On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c | 92d ago |
| CVE-2026-9492 | 7.8 | — | — | — | — | The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology ha | 94d ago |
| CVE-2026-7162 | 7.8 | — | — | — | — | Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level acces | 94d ago |
| CVE-2026-15506 | 7.8 | — | — | — | — | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. | 94d ago |
| CVE-2026-10667 | 7.8 | — | — | — | zephyrproject / zephyr | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a do | 94d ago |
| CVE-2026-7639 | 7.8 | — | — | — | imaginationtech / ddk | Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use | 96d ago |
| CVE-2026-45203 | 7.8 | — | — | — | imaginationtech / ddk | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a | 96d ago |
| CVE-2026-45196 | 7.8 | — | — | — | imaginationtech / ddk | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a | 96d ago |
| CVE-2026-41154 | 7.8 | — | — | — | imaginationtech / ddk | Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API ca | 96d ago |
| CVE-2026-34196 | 7.8 | — | — | — | imaginationtech / ddk | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer over | 96d ago |
| CVE-2026-61437 | 7.8 | — | — | — | — | PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in A | 96d ago |
| CVE-2026-59858 | 7.8 | — | — | — | vim / vim | Vim is an open source, command line text editor. | 97d ago |
| CVE-2026-59856 | 7.8 | — | — | — | vim / vim | Vim is an open source, command line text editor. | 97d ago |
| CVE-2026-0278 | 7.8 | — | — | — | paloaltonetworks / prisma access agent | Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows | 97d ago |
| CVE-2026-0276 | 7.8 | — | — | — | paloaltonetworks / cortex xdr broker vm | A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated us | 97d ago |
| CVE-2026-58459 | 7.8 | — | — | — | gpsd project / gpsd | gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that a | 97d ago |
| CVE-2026-47829 | 7.8 | — | — | — | cloudfoundry / bosh cli | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the loc | 98d ago |
| CVE-2026-41857 | 7.8 | — | — | — | cloudfoundry / bosh cli | A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when t | 98d ago |
| CVE-2026-55878 | 7.8 | — | — | — | — | Symfony UX is a JavaScript ecosystem for Symfony. | 98d ago |
| CVE-2026-39822 | 7.8 | — | — | — | golang / go | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when th | 98d ago |
| CVE-2026-22927 | 7.8 | — | — | — | omnissa / workspace one tunnel | Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. | 98d ago |
| CVE-2026-57260 | 7.8 | — | — | — | foxit / pdf editor | The application opened a PDF file containing an abnormal Unity 3D object. | 98d ago |
| CVE-2026-57256 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, a | 98d ago |
| CVE-2026-57254 | 7.8 | — | — | — | foxit / pdf editor | There is an abnormal annotation within the PDF that is referenced by other objects. | 98d ago |
| CVE-2026-57252 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment ann | 98d ago |
| CVE-2026-57251 | 7.8 | — | — | — | foxit / pdf editor | The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an | 98d ago |
| CVE-2026-57250 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. | 98d ago |
| CVE-2026-57249 | 7.8 | — | — | — | foxit / pdf editor | After the application opened the PDF file, the script first reset the annotation status, then triggered the reset | 98d ago |
| CVE-2026-57248 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient o | 98d ago |
| CVE-2026-57247 | 7.8 | — | — | — | foxit / pdf editor | The application re-enters the document structure via field processing and deletes the current page, and then conti | 98d ago |
| CVE-2026-57246 | 7.8 | — | — | — | foxit / pdf editor | When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers sign | 98d ago |
| CVE-2026-57245 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to | 98d ago |
| CVE-2026-57244 | 7.8 | — | — | — | foxit / pdf editor | After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle ve | 98d ago |
| CVE-2026-57242 | 7.8 | — | — | — | foxit / pdf editor | The application opens the PDF, and JavaScript modifies the form. | 98d ago |
| CVE-2026-57240 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the o | 98d ago |
| CVE-2026-57238 | 7.8 | — | — | — | foxit / pdf editor | After the application opened the PDF, JavaScript deleted the form field object. | 98d ago |
| CVE-2026-57237 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the | 98d ago |
| CVE-2026-56000 | 7.8 | — | — | — | x.org / x server | Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xway | 98d ago |
| CVE-2026-13129 | 7.8 | — | — | — | foxit / pdf editor | When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resultin | 98d ago |
| CVE-2026-13128 | 7.8 | — | — | — | foxit / pdf editor | Embedding JavaScript within a PDF file will cause the page to be deleted. | 98d ago |
| CVE-2026-13127 | 7.8 | — | — | — | foxit / pdf editor | The application opens the PDF file. | 98d ago |
| CVE-2026-13126 | 7.8 | — | — | — | foxit / pdf editor | The embedded JavaScript in the PDF deleted the pages, making the object invalid. | 98d ago |
| CVE-2026-57895 | 7.8 | — | — | — | — | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. | 99d ago |
| CVE-2026-56437 | 7.8 | — | — | — | — | Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. | 99d ago |
| CVE-2026-49033 | 7.8 | — | — | — | — | The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execu | 99d ago |
| CVE-2026-42958 | 7.8 | — | — | — | — | The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while par | 99d ago |
| CVE-2026-57851 | 7.8 | — | — | — | — | MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver tha | 99d ago |
| CVE-2026-25271 | 7.8 | — | — | — | qualcomm / cologne firmware | Memory Corruption when processing asynchronous input parameters due to improper handling of modified values betwee | 100d ago |
| CVE-2026-21379 | 7.8 | — | — | — | qualcomm / aqt1000 firmware | Memory Corruption when allocating memory with sizes that exceed the maximum allowed value. | 100d ago |
| CVE-2026-6509 | 7.8 | — | — | — | — | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows | 101d ago |
| CVE-2026-53362exploited | 7.8 | 0.71% | 3/3 | +54d | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocat | 102d ago |
| CVE-2026-12252 | 7.8 | — | — | — | nltk / nltk | In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, St | 103d ago |
